Local privilege escalation in Microsoft Office Click-To-Run allows an attacker who already holds a low-privileged foothold on a Windows host to turn a use-after-free (CWE-416) memory-corruption flaw into full compromise of the affected process context, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and no user interaction required. The affected deployments are Microsoft Office installed and serviced through Click-To-Run: Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Because the vector is AV:L/PR:L, this is an authenticated, post-access escalation primitive rather than a remote or unauthenticated attack path, and no public exploit code or confirmed active exploitation was identified at the time of analysis; Microsoft has released patched builds. The practical risk is bounded by the prerequisite initial foothold, and reliable exploitation additionally depends on winning the heap reuse/grooming required to control the freed object.
Local privilege escalation in the Microsoft Account component of supported Windows client and server releases lets an attacker who already holds a valid low-privileged local account turn that foothold into full system-level control through a heap memory corruption bug. The flaw is a heap-based buffer overflow (CWE-122) reachable with low privileges and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it is a post-compromise escalation primitive rather than a remote entry point; there is no network attack path. Exploitation has not been observed: CISA's SSVC assessment records Exploitation as none and no public exploit code has been identified at time of analysis, and Microsoft has shipped a vendor patch covering all listed Windows builds, making this a genuine but non-emergency remediation priority concentrated on shared or multi-user hosts.
Local code execution in Microsoft Windows HTTP.sys affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, including Server Core installations. An attacker who already holds a valid low-privilege authenticated session on the host (CVSS vector AV:L/PR:L/UI:N) can trigger an out-of-bounds read in the HTTP kernel driver with no user interaction, delivering high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released fixes; multi-user hosts such as RDP/terminal servers, where untrusted users hold local accounts, carry the highest realistic exposure.
Local privilege escalation in the Microsoft Graphics Component affects multiple Windows client and server builds, allowing a local, authenticated attacker with low privileges (CVSS AV:L/PR:L) to exploit a numeric truncation error and gain High confidentiality, integrity, and availability impact after corrupting heap memory. The vulnerability has a CVSS 3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction, and is not a remote entry point; no public exploit was identified at time of analysis, and no EPSS score was provided. A vendor patch is available per Microsoft, so affected organizations should prioritize update deployment on all listed Windows versions and Server Core installations.
Local privilege escalation in Microsoft Streaming Service on Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025 allows an authenticated, low-privilege attacker who already has code execution on the host to exploit an integer wraparound and elevate privileges, with total impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is strictly local - the vector (AV:L/PR:L/UI:N) rules out remote or unauthenticated reach - and SSVC records exploitation as none with automatable set to no, so no public exploit code has been identified at time of analysis. This is a genuine patch-priority issue but not an emergency, and it matters most on multi-user, terminal-server and jump hosts where untrusted users can already run code.
Heap-based buffer overflow in the Microsoft Streaming Service (the Windows kernel streaming subsystem, including mskssrv) permits a locally authenticated attacker to elevate privileges on affected Windows hosts. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is a privilege-escalation primitive, not a remote entry point - the attacker must already hold low-privileged local code execution on the target machine before it can be triggered, and no victim interaction is required (UI:N). At time of analysis there is no public exploit identified, CISA KEV does not list the CVE, and CISA's SSVC decision framework records Exploitation: none with Automatable: no, so this is a credible but not emergency-priority issue; a vendor patch is available and version-specific fixed builds are published in the Microsoft advisory.
Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in the Windows HID class driver allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM by sending crafted HID input, with a CVSS 3.1 base score of 7.8. The flaw requires local access (PR:L) and cannot be triggered remotely, and no public exploit code or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft Security Response Center advisory.
Local privilege escalation in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows 11 and Windows Server systems. Exploitation requires local interaction with unionfs.sys and cannot be used for remote or initial compromise; the affected unpatched builds include Windows 11 23H2/24H2/25H2/26H2 and Windows Server 2022/2025. Vendor patches are available, no public exploit was identified at time of analysis, and this is a credible but second-tier priority for most environments.
Local privilege escalation in the Windows Geotag Broker component of Microsoft Windows lets an authenticated low-privileged user already running code on a host elevate to a higher-integrity context, with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating high impact to confidentiality, integrity and availability and no user interaction required. Affected systems are unpatched Windows 10, Windows 11 and Windows Server builds below the fixed build numbers published by the vendor, including Server Core installations; exploitation requires local interactive or code-execution access (PR:L, AV:L), so risk is concentrated on multi-user hosts such as RDP/terminal servers, shared workstations and systems where untrusted users can run code. There is no public exploit identified at time of analysis and no CISA KEV listing, and Microsoft has released a vendor patch - this is a patch-priority issue rather than a remotely exploitable emergency.
Local privilege escalation in Windows Kernel-Mode Drivers lets an attacker who already holds low-privileged, authenticated access to a Windows host (CVSS PR:L, AV:L) exploit improper access control (CWE-862) to gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact. Affected builds span Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2025 (including Server Core installations); no user interaction is required, but there is no remote or network attack path, so the flaw is a post-compromise escalation primitive rather than an initial access vector. There is no public exploit identified at time of analysis and CISA's SSVC evaluation records exploitation as 'none' with automatable 'no', though technical impact is rated total; EPSS and KEV data were not provided, and a vendor patch is available per Microsoft's advisory.
Local privilege escalation in Microsoft Windows Server Update Service (WSUS) allows an authenticated attacker who already holds a low-privileged foothold on a WSUS-enabled host to escalate to higher privileges, with total impact to confidentiality, integrity, and availability (CVSS 7.8, C:H/I:H/A:H). Only servers with the WSUS role installed are exposed, and only builds below the vendor-supplied fixed levels are affected (e.g., Server 2025 < 10.0.26100.33650, Server 2022 < 10.0.20348.5761, Server 2019 < 10.0.17763.9376, Server 2016 < 10.0.14393.9612, Server 2012 R2 < 6.3.9600.23470, Server 2012 < 6.2.9200.26434, plus Windows 10 1607/1809). There is no remote or unauthenticated path (AV:L/PR:L/UI:N), no public exploit identified at time of analysis per CISA SSVC (Exploitation: none) and no KEV listing; Microsoft has released patches.
Local privilege escalation in the Windows Server Update Service (WSUS) lets an authenticated low-privileged user on a WSUS-enabled host gain elevated privileges, rooted in CWE-1220 (insufficient granularity of access control) and rated 7.8 under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the WSUS role or component to be present on the target and the attacker to already hold local low-privileged access; no user interaction or unusual complexity is needed, but an unauthenticated or purely remote attacker cannot trigger it from this vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with non-automatable characteristics, and vendor patches are available from Microsoft for all affected builds.
Windows Credential Guard does not enforce authentication on a critical function, letting a local, already-authenticated low-privileged user on an affected Windows host perform spoofing (CVSS 7.8, CWE-306). Exploitation is strictly local and requires prior account access to the machine, so exposure is concentrated on multi-user, shared, or already-compromised endpoints running Credential Guard rather than internet-facing systems; the specific function or configuration state involved is not described in the available sources. Microsoft has released fixed builds for Windows 10, Windows 11 and Windows Server, and no public exploit or CISA KEV entry is associated with the CVE at time of analysis; EPSS is 0.30% (22nd percentile), consistent with a moderate, this-week priority rather than emergency response.
Local privilege escalation in the Windows Audio Service lets an authenticated low-privilege user on affected Windows 11 builds (24H2, 25H2, 26H1, 26H2) have attacker-controlled content accepted as trusted, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. Exploitation is local-only and requires an existing foothold (PR:L) with no user interaction (UI:N) and low complexity (AC:L), so escalation is reliable once the attacker is on the host, though limiting factors are the mandatory authenticated local access and the fact that patched builds are not exploitable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
Improper access control in the WebDAV component of Microsoft Windows lets a locally authenticated low-privilege user elevate privileges to full system integrity, giving complete compromise of confidentiality, integrity, and availability on the affected host. Exploitation is strictly local (AV:L) with a valid low-privileged account and no user interaction (PR:L, UI:N); there is no remote or network vector, and the attacker must already hold a foothold on the machine, which caps real-world risk. Microsoft has released a vendor patch, no public exploit code has been identified, and CISA's SSVC assessment records exploitation as "none" and automatable as "no", so this is a genuine but not emergency-level priority. Affected builds are all Windows client and server releases below the fixed build numbers catalogued in EUVD-2026-100091, and hosts that have the WebClient/WebDAV service disabled have a materially reduced attack surface.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authenticated attacker who already holds low-privileged code execution on the host to elevate to a higher-integrity context, with total impact to confidentiality, integrity and availability. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms the flaw is only reachable from a local session by a low-privileged principal, requires no user interaction, and needs no non-default feature to be enabled, so every unpatched build of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 23H2 and Windows Server 2012 through 2025 is exposed once an attacker has a foothold; there is no remote or network-reachable path. CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis; Microsoft has published a fix, making this a credible but not emergency-tier patching priority whose practical abuse case is post-access escalation on already-breached or multi-user hosts.
Local privilege escalation in the Windows Device Install Service lets an authenticated attacker holding only low-level privileges on a host raise their rights to a higher integrity level (CVSS 3.1 base 7.8 High, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is an incorrect authorization check (CWE-863) in a service that normally runs with high privileges, so any standard user who can already execute code - or plug in or trigger a device installation - on an unpatched Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 system is a potential victim; default configurations are affected and no user interaction is needed. Microsoft has published a fix, and there is no public exploit identified at time of analysis and no CISA KEV listing or SSVC exploitation signal, though the SSVC technical impact rating is "total" because successful exploitation yields high confidentiality, integrity, and availability impact within the same security scope.
Local privilege escalation in the Windows Virtual Input component allows an authenticated, low-privileged attacker to gain elevated rights on affected Windows 10, Windows 11 and Windows Server hosts. Exploitation requires an attacker to already hold a local interactive foothold on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and to trigger an improper authorization check in the component (CWE-283, Unverified Ownership); no victim interaction is required and attack complexity is low, so escalation is straightforward once local access exists. A vendor patch is available from Microsoft, no public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with the flaw judged not automatable, indicating it is not suitable for mass, scalable attacks.
Local privilege escalation in Microsoft Windows Modern Device Management (MDM) stems from a critical function that performs no authorization check (CWE-306), letting an attacker who already holds a low-privilege authenticated local account on the host elevate to higher privileges, including SYSTEM. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 (including Server Core) below their respective fixed builds. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confines this to post-compromise escalation - there is no remote network attack path and no user interaction required - and no public exploit code was identified at time of analysis, with CISA SSVC recording exploitation as 'none' and automatable as 'no'.
Local privilege escalation in Windows Group Policy allows an authenticated, low-privileged attacker who already has interactive or code-execution access on a Windows host to elevate privileges to a higher-integrity context. The flaw is an access-control weakness (CWE-862) in how a privileged Group Policy operation is authorized, requiring no user interaction (UI:N) and low attack complexity (AC:L) once a foothold exists, which makes it most impactful on shared multi-user systems such as terminal/RDS servers, VDI hosts, and domain-joined endpoints where untrusted users hold accounts. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is credited as the reporting vendor.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Local privilege escalation in the Windows User Profile Service (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) lets an attacker who already holds valid low-privileged local access redirect privileged file operations through attacker-created symbolic links, junctions, or hardlinks, yielding high-integrity file writes that can be leveraged for SYSTEM-level code execution. Affected are all currently supported Windows client and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - and default configurations are vulnerable with no special feature needing to be enabled. Vendor-released patches are available from Microsoft; no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so priority should track routine monthly patching rather than emergency response.
Local privilege escalation in the Windows Direct Composition (dcomp) compositor lets a low-privileged, already-authenticated local attacker drive a use-after-free (CWE-416) and gain high-integrity code execution (C:H/I:H) on affected Windows 10, Windows 11 and Windows Server builds. Exploitation is post-foothold only: the CVSS vector (AV:L, PR:L, UI:N) requires the attacker to already hold local code execution, so this is not a remotely reachable entry point and no user interaction is needed once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a patch-now local escalation rather than a drop-everything emergency; fully patched systems at or above the fixed builds are unaffected.
Heap-based buffer overflow in Microsoft Windows Hyper-V allows a locally positioned, authenticated attacker to execute code that crosses the hypervisor isolation boundary, escaping from a guest virtual machine into the host (parent) partition. Exploitation requires the attacker to already have low-privileged code execution inside a guest VM on the affected host, and the high attack complexity rating indicates an additional hurdle such as a race window or a precise heap layout, so a successful overflow is not deterministic. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and no automatable path, though a vendor patch is available and the technical impact of a successful escape is total. Only unpatched builds below the fixed thresholds (for example Windows Server 2025 below 10.0.26100.33650 and Windows 11 24H2 below 10.0.26100.9711) are affected.
Local privilege escalation in Microsoft Windows Media Foundation allows an attacker who already holds a low-privileged, authenticated local account to drive the media decoding pipeline into a heap-based buffer overflow and corrupt memory in a higher-privileged context. The issue is rated 7.8 (AV:L/AC:H/PR:L/UI:N, scope unchanged in our independent assessment) and per that vector is neither remote nor unauthenticated, and needs no victim interaction - the practical barriers are the local-access prerequisite and the high attack complexity of controlling the heap layout. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this is a genuine patch-priority item rather than an emergency; vendor patches are available per Microsoft's update guide.
Local privilege escalation in Windows Desktop Window Manager allows a low-privileged attacker who already has code execution on a host to corrupt DWM's heap and escalate to a higher-integrity, SYSTEM-level context. Microsoft rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing local foothold under a valid account (PR:L) attained through local interaction with DWM (AV:L), with no victim user interaction (UI:N) and low attack complexity, making it a straightforward post-compromise escalation step rather than a remotely reachable flaw. Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26Hx) and Windows Server 2019/2022/2025 builds below the fixed versions are affected; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are available. This is a credible operational priority but not a mass-exploitation emergency.
Local privilege escalation in the Windows Graphics Kernel allows an attacker who already holds low-privileged code execution on a target host to elevate to SYSTEM through a use-after-free (CWE-416) memory corruption flaw in the kernel-mode graphics subsystem. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is authenticated in the sense that the attacker must already have a local foothold; no user interaction is required and there is no remote or network vector, so this is a post-compromise escalation primitive rather than an initial access path. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2025 (including Server Core installations); no public exploit code has been identified at time of analysis, EPSS is low at 0.27% (17th percentile), CISA SSVC records no known exploitation, and a vendor patch is available.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
A use-after-free in the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService) lets an attacker who already holds a low-privileged local session elevate privileges on the affected host, with high impact to confidentiality, integrity and availability. Microsoft scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the affected service ships enabled by default across the listed Windows 10, Windows 11 and Windows Server 2019 build ranges, so exposure depends almost entirely on whether untrusted users can obtain interactive or code-execution access to the machine. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a credible but not emergency-tier patch priority rather than an actively exploited emergency; the limiting factor is the local attack vector, since there is no network-reachable exploitation path.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds a foothold on a Windows host to escalate to SYSTEM-level privileges by triggering a heap-based buffer overflow (CWE-122). The flaw carries a CVSS 3.1 base score of 7.8 on a strictly local vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no victim interaction and no network path are required, but the attacker must already be able to run code or hold a valid session on the target. Microsoft has published fixed builds covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and no public exploit has been identified at time of analysis (SSVC exploitation: none, Automatable: no); this is a credible moderate-priority privilege-escalation issue rather than a remote-exploitation emergency.
Local privilege escalation in the Windows Kernel (CWE-190 integer overflow or wraparound) lets an attacker who already holds a low-privileged authenticated session on a target host elevate to kernel-level code execution, with high impact to confidentiality, integrity, and availability. Exploitation is local-only and unauthenticated remote paths do not exist: the CVSS vector (AV:L/PR:L/UI:N) confirms a valid low-privileged local account is required and no user interaction is needed once that foothold exists, so this is an escalation primitive that must be chained behind a separate initial-access or credential-compromise step. All unpatched supported Windows 10, Windows 11 (including 23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 builds listed in the EUVD data are affected; there is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and a vendor patch is available. This is a credible mid-to-high priority patch item, not an alarmist one.
Local privilege escalation in Microsoft Windows Direct Composition lets an attacker who already holds a low-privileged, authenticated foothold on the host trigger a use-after-free (CWE-416) and execute code at a higher integrity level, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because exploitation requires local, authenticated access with low privileges and cannot be reached remotely or by an unauthenticated attacker, realistic risk is concentrated in post-compromise, local-malware, and malicious-insider scenarios; CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis. Vendor-released patches exist for every affected Windows client and server branch, so exposure is primarily a patch-latency problem rather than an emergency remote threat.
Local privilege escalation in the Windows Win32 kernel subsystem lets an authenticated attacker who already has a low-privileged foothold on a Windows host elevate to SYSTEM-level privileges. Exploitation requires existing local code execution (CVSS AV:L/PR:L) but needs no user interaction and is low-complexity, so the flaw is best understood as a post-access escalation step rather than a remotely reachable bug; Windows 11 24H2 below build 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807 and the other enumerated SKUs are affected. Intelligence does not indicate active exploitation (CISA SSVC Exploitation: none) and no public exploit code has been identified at time of analysis, though CISA's SSVC assessment rates technical impact as total and the flaw is rated High (7.8) for confidentiality, integrity and availability.
Local privilege escalation in Windows Storage Spaces allows an authenticated standard user to trigger a heap-based buffer overflow in the Storage Spaces Controller and gain elevated code execution on affected Windows 10, Windows 11, and Windows Server hosts. The flaw is not remotely reachable and requires prior local access (CVSS AV:L/PR:L), so it is most relevant as a post-compromise escalation step; EPSS is 0.26% and no public exploit has been identified at time of analysis. Microsoft has released updates for the affected Windows builds.
Arbitrary code execution in Adobe FrameMaker is possible via a heap-based buffer overflow (CWE-122) that is triggered when the victim opens a specially crafted file. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (score 7.8) indicates the flaw is local to the desktop application, requires user interaction, needs no prior authentication, and gives the attacker only the privileges of the user who opens the document. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the main risk is social engineering against FrameMaker users.
Heap-based buffer overflow in Adobe FrameMaker (CWE-122) lets an attacker achieve arbitrary code execution in the context of the user who opens a crafted FrameMaker document. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no prior authentication or privileges are needed, but exploitation depends on the victim opening an attacker-supplied file, and code runs only with that user's rights due to unchanged scope. Impact is therefore bounded by the victim's privilege level and by successful social engineering; there is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited.
Heap-based buffer overflow in the Microsoft Internet Messaging API (IMAPI, delivered by the inetcomm component) allows an attacker who already holds a low-privileged authenticated session on a Windows host to run arbitrary code in the context of the vulnerable component. The scored vector is strictly local (AV:L, PR:L, UI:N, S:U), so a prior foothold or valid credentials on the machine are a hard prerequisite and no user interaction is required once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is already available, making this a credible but not emergency-tier patching priority.
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on the host to elevate to SYSTEM-level privileges by winning a timing-sensitive use-after-free in kernel memory. The flaw affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025 builds below their respective patched build numbers; there is no remote or network path and no user interaction is required, but exploitation demands an existing local foothold and an account (PR:L) plus a non-trivial race condition (AC:H), so success is not guaranteed. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the SSVC assessment records exploitation as 'none'; the CISA SSVC technical impact is rated 'total', and vendor patches are available.
A local privilege escalation vulnerability in the Windows Storage VSP (Virtual Storage Provider) driver allows a low-privileged, authenticated attacker with existing code execution on a Windows host to elevate to SYSTEM-level privileges by triggering a use-after-free race condition in the driver. The flaw affects a broad range of Windows client and server platforms, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2016 through Windows Server 2025, and carries a CVSS 3.1 score of 7.8. Exploitation is difficult because it depends on winning a race condition (AC:H) and the CISA SSVC assessment rates it as not automatable with no known exploitation, so no public exploit code or active in-the-wild abuse has been identified at time of analysis.
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.
Arbitrary code execution in Adobe Substance 3D Sampler 6.0.3 and earlier is possible because a stack-based buffer overflow (CWE-121) is triggered when the application parses a specially crafted file, with any code executed inheriting the privileges of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) shows no privileges are required, but the attack is not network-reachable: the attacker must first deliver the malicious file and rely on the victim opening it in the application. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuinely moderate-risk desktop issue rather than a top-priority emergency, though the high confidentiality, integrity, and availability impact on the user's session justifies prompt patching.
Local privilege escalation in the Windows Mobile Broadband (WWAN) component on Windows 11 allows an authenticated, low-privileged attacker to gain elevated privileges. The flaw is caused by incorrect permission assignment (CWE-732) on a critical resource, affecting default installations of Windows 11 24H2, 25H2, 26H1, and 26H2 below their respective patched revisions. No public exploit identified at time of analysis; exploitation requires local access and a low-privileged session, making it a post-compromise escalation vector.
Local code execution in the Windows Universal Disk Format File System Driver (UDFS) affects all supported Windows 10, Windows 11, and Windows Server editions when the driver parses a malformed UDF volume. Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so a crafted or corrupted UDF-formatted optical disc or UDF/ISO image file must be mounted or read on the target host before the flaw can be reached; a successful trigger provides full confidentiality, integrity, and availability impact within the kernel context. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, and our independent assessment rates this as a credible but not emergency-tier priority given the mandatory local foothold and physical/media-adjacent delivery path.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in Microsoft Windows DWM Core Library allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows hosts by triggering an out-of-bounds read (CWE-125) in the desktop compositor. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and affects a broad set of Windows 10, Windows 11, and Windows Server builds, including Server Core; no user interaction is required. Microsoft has released a vendor patch, and no public exploit was identified at time of analysis, so patching and reducing untrusted local code execution are the primary risk-reduction steps.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated local user who already has low-privileged code execution on a Windows host to elevate their privileges (CVSS 7.8 HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-125 out-of-bounds read). Affected are unpatched Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H2) and Windows Server 2019/2022/2025 installations, including Server Core builds, since the DWM Core Library is present and active by default on every supported installation. Exploitation status: no public exploit identified at time of analysis, CISA SSVC rates Exploitation as none and Automatable as no, and the attack is per-host, requires prior local code execution, and is not remote or network-facing; a vendor patch is available and hosts updated to the fixed builds are not affected.